前端在调用 Django 后端时，遇到跨域问题，提示如：

has been blocked by CORS policy: Request header field cache-control is not allowed by Access-Control-Allow-Headers in preflight response.

解决办法，安装 django-cors-headers 插件.

https://github.com/adamchainz/django-cors-headers

1.跨域插件安装

pip install django-cors-headers

2.跨域插件配置

参考：django-cors-headers实现跨域的方法总结 - 知乎

编辑 setting.py 文件，添加如下内容：

2.1.INSTALLED_APPS

INSTALLED_APPS = [
    ...
    'corsheaders'，
    ...
 ]

2.2.MIDDLEWARE 和 MIDDLEWARE_CLASSES

MIDDLEWARE = [
    'corsheaders.middleware.CorsMiddleware',
    'django.middleware.security.SecurityMiddleware',
    'django.contrib.sessions.middleware.SessionMiddleware',
    'django.middleware.common.CommonMiddleware',
    #'django.middleware.csrf.CsrfViewMiddleware',
    'django.contrib.auth.middleware.AuthenticationMiddleware',
    'django.contrib.messages.middleware.MessageMiddleware',
    'django.middleware.clickjacking.XFrameOptionsMiddleware',
]

MIDDLEWARE_CLASSES = [
    'corsheaders.middleware.CorsMiddleware',
    'django.middleware.security.SecurityMiddleware',
    'django.contrib.sessions.middleware.SessionMiddleware',
    'django.middleware.common.CommonMiddleware',
    #'django.middleware.csrf.CsrfViewMiddleware',
    'django.contrib.auth.middleware.AuthenticationMiddleware',
    'django.contrib.messages.middleware.MessageMiddleware',
    'django.middleware.clickjacking.XFrameOptionsMiddleware',
]

2.3.ALLOW

CORS_ALLOW_CREDENTIALS = True
CORS_ORIGIN_ALLOW_ALL = True
CORS_ORIGIN_WHITELIST = []

CORS_ALLOW_METHODS = [
    'DELETE',
    'GET',
    'OPTIONS',
    'PATCH',
    'POST',
    'PUT',
    'VIEW',
]

CORS_ALLOW_HEADERS = [
    'accept',
    'accept-encoding',
    'authorization',
    'content-type',
    'dnt',
    'origin',
    'user-agent',
    'x-csrftoken',
    'x-requested-with',
]

3. Forbidden (CSRF cookie not set.）报错

参考：django中遇到错误：Forbidden CSRF cookie not set - 知乎

CSRF表示 django 全局发送 post 请求均需要字符串验证.

功能： 防止跨站请求伪造的功能

工作原理：客户端访问服务器端，在服务器端正常返回给客户端数据的时候，而外返回给客户端一段字符串，等到客户端下次访问服务器端时，服务器端会到客户端查找先前返回的字符串，如果找到则继续，找不到就拒绝。

访问流程：客户端 -》URL路由系统 -》 CSRF -》视图函数

解决办法：编辑 setting.py 中MIDDLEWARE 参数，注释掉 'django.middleware.csrf.CsrfViewMiddleware'.

如：

MIDDLEWARE = [
    'corsheaders.middleware.CorsMiddleware',
    'django.middleware.security.SecurityMiddleware',
    'django.contrib.sessions.middleware.SessionMiddleware',
    'django.middleware.common.CommonMiddleware',
    #'django.middleware.csrf.CsrfViewMiddleware', #注释掉
    'django.contrib.auth.middleware.AuthenticationMiddleware',
    'django.contrib.messages.middleware.MessageMiddleware',
    'django.middleware.clickjacking.XFrameOptionsMiddleware',
]